Applies to BloodHound Enterprise and CE

Representation

The Base node is the basis for all other Active Directory nodes and is used when a node type is unknown, for example, after an object is deleted. The node is retained as it may have edges linked to/from it.

Node properties

The node supports the properties of the table. Three types of property names will be used, depending on where the property is found:

  • Entity Panel: Name shown in the BloodHound UI.
  • Database: Name stored in the BloodHound database and returned by the BloodHound API. This is to be used when running Cypher queries.
  • Directory: Name collected from the directory the node is stored in, for example, the LDAP name for an Active Directory property.
Entity PanelDatabaseDirectoryDescription
Object IDobjectid-The object’s unique identifier in the directory.
Last Collected by BloodHoundlastcollected-The most recent time the object was collected and ingested in BloodHound.
Last Seen by BloodHoundlastseen-The most recent time the object or a reference to it was collected and ingested in BloodHound.
-name-Object ID of the object.

Edges

Any edge type may be linked to/from this node. See the edges documentation for more information on the edge types.

Applies to BloodHound Enterprise and CE

Representation

The Base node is the basis for all other Active Directory nodes and is used when a node type is unknown, for example, after an object is deleted. The node is retained as it may have edges linked to/from it.

Node properties

The node supports the properties of the table. Three types of property names will be used, depending on where the property is found:

  • Entity Panel: Name shown in the BloodHound UI.
  • Database: Name stored in the BloodHound database and returned by the BloodHound API. This is to be used when running Cypher queries.
  • Directory: Name collected from the directory the node is stored in, for example, the LDAP name for an Active Directory property.
Entity PanelDatabaseDirectoryDescription
Object IDobjectid-The object’s unique identifier in the directory.
Last Collected by BloodHoundlastcollected-The most recent time the object was collected and ingested in BloodHound.
Last Seen by BloodHoundlastseen-The most recent time the object or a reference to it was collected and ingested in BloodHound.
-name-Object ID of the object.

Edges

Any edge type may be linked to/from this node. See the edges documentation for more information on the edge types.